CVE-2026-124481: OpenEMR before 8.4.0 Cross-Patient Payment Tampering via Rainforest Portal Payments

Published Nov 8, 2026

Updated

OpenEMR before 8.4.0 contains an improper authorization vulnerability in Rainforest patient portal payments that trusts browser-supplied patientId, encounter, and amount values instead of deriving them from the portal session. Authenticated portal patients can tamper with JSON sent to portalpayment.rainforest.php so the payin.authorized webhook writes forged aractivity credits to other patients' encounters exceeding the amount actually paid.

Event History

Nov 8, 2026

CVE Published

via MITRE·01:16 PM

Data Sourced

via MITRE·01:16 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·02:18 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

An authenticated patient portal user can exploit it. The attack is network-accessible and does not require user interaction, but it requires portal credentials.

Which deployments are affected?

OpenEMR deployments before version 8.4.0 are affected when they use Rainforest patient portal payments. The vulnerable payment endpoint is portal_payment.rainforest.php.

What can an attacker change?

The attacker can modify browser-supplied patientId, encounter, and amount values in payment JSON. A payin.authorized webhook can then create forged ar_activity credits for another patient's encounter, including credits greater than the amount actually paid.

What should be reviewed to identify possible exploitation?

Review ar_activity credits created through Rainforest payin.authorized webhooks, especially credits whose recorded amount exceeds the corresponding payment. Also investigate credits assigned to a patient or encounter that does not match the portal user who initiated the payment.

CVE-2026-124481: OpenEMR before 8.4.0 Cross-Patient Payment Tampering via Rainforest Portal Payments

Event History

Frequently Asked Questions

Who can exploit this issue?

Which deployments are affected?

What can an attacker change?

What should be reviewed to identify possible exploitation?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

Which deployments are affected?

What can an attacker change?

What should be reviewed to identify possible exploitation?